Privacy Policy - Uncrush

Effective date: 2026-05-01 Last reviewed: 2026-05-01 Controller: Twilper, KvK 98440217, Merelstraat 64, 8916 AX Leeuwarden, NL Contact: privacy@uncrush.app

This is the public privacy policy. The Dutch jurist review is scheduled before launch (PLAN.md §8). Version history is in git so changes are traceable.

1. Plain-language summary

Uncrush is a tool for stepping out of limerence. To work, it needs to remember what you write to it: your spiral chats, daily tracker, assessment answers, unsent letters, and reality-tests. We treat all of that as special-category personal data because it is mental-health-adjacent.

In short: - We do not sell your data. Ever. - We do not use your data to train AI models. - We do not track you across the web. There is no Facebook pixel, no Google Analytics in the app. - You can export everything you wrote at any time. - You can delete your account, and everything in it, with one tap. - The AI coach is shipped under a behavioural contract that forbids validating your obsession; outputs are server-filtered.

If something below is unclear, email privacy@uncrush.app.

2. What we collect

3. What we do NOT collect

• Your phone number (the buddy phone is your friend's, not yours)
• Your location, calendar, contacts, photos, microphone, or camera
• Your IP address past authentication
• A device fingerprint or ad ID
• Any third-party analytics in the app (no Google Analytics, no Mixpanel, no Meta pixel, no Branch)
• The limerent object's data as a separate subject. Names that appear in your free-text are user content and never enriched.

4. AI providers and where your text goes

When you use the spiral coach or the AI co-write feature for letters, the text you type and the relevant context are sent to one of two providers:

• DeepSeek (default, China-hosted): under a Standard Contractual Clauses (SCC) addendum + zero-data-retention API flag. Pseudonymous: only locale and chat content go through; no email or IP. We also document a Schrems-II Transfer Impact Assessment in docs/DPIA.md §6.
• Mistral (opt-in, EU-hosted in France): activate Settings -> "EU-only AI provider" if you want your AI calls to stay within the EU.

Either provider may be used; we tell the user which provider answered (visible in audit logs the user can request). Neither provider trains on your data because both have zero-retention contracts in place.

The on-device coach memory we build for you is also limited to 50 short facts, viewable + deletable in Settings -> "What the coach remembers".

5. Sub-processors

We never add a sub-processor without first updating this page and giving 7 days' notice in the in-app changelog.

6. Your rights (AVG art. 15-22)

You can exercise any of these from inside the app or by emailing privacy@uncrush.app. We respond within 30 days as the law requires, usually sooner.

• Access (art. 15): Settings -> "Export" gives you all your data as JSON, instantly.
• Therapist hand-off: Settings -> "Export for therapist" shares a 30-day Markdown summary you can send or print.
• Rectification (art. 16): edit anything through the app's normal screens. The coach memory page lets you correct stale facts.
• Erasure (art. 17): Settings -> Delete account. Hard-delete, no soft-state, no shadow profile.
• Restriction (art. 18): email us; we freeze processing within 7 days.
• Portability (art. 20): Export returns JSON.
• Object (art. 21): turn off the AI audit sample in Settings (you can also opt out of the EU-default DeepSeek provider via the EU-only toggle).
• Withdraw consent (art. 7.3): at any time, in Settings.
• Lodge a complaint: NL Autoriteit Persoonsgegevens at autoriteitpersoonsgegevens.nl.

7. Crisis-safety architecture

• Server-side regex detects crisis language in user input (suicidal ideation, self-harm, stalking-plan language) BEFORE any AI call. When triggered, the user gets a hotline-only response (113.nl in NL, 988 in US, country-specific elsewhere).
• The AI output is post-filtered server-side: phrases that validate obsession or imply reunion are replaced with a grounding fallback.
• 113.nl / 988 / country-specific lines are reachable in one tap from the home topbar and from inside the spiral coach.
• We are not a crisis service. The disclaimer in onboarding is explicit.

8. Data minimisation choices we make

• The trial does NOT require email confirmation. You can use the 7 days without proving the email address; we ask for verification only when you want password recovery.
• Free-text fields are not analyzed except to do the feature you asked for (e.g., letters are NEVER read by the AI unless you press "Help me continue").
• We do not log analytics events for screen views inside the app.
• We do not log IP addresses past the JWT issuance.
• We do not retain push-notification tokens after you log out.

9. Children

The service is for adults. We require self-attested age 16+ at signup. If we learn a user is under 16, we delete their account.

10. Changes

We update this policy when we add a sub-processor, change a retention rule, or expand the data we process. The change is announced with 7 days' notice in the in-app changelog and at /privacy on the landing page. Old versions are kept in git history.

11. Contact

privacy@uncrush.app Twilper, Merelstraat 64, 8916 AX Leeuwarden, NL KvK 98440217 - BTW NL005332508B94

Uncrush by Twilper, KvK 98440217, Merelstraat 64, 8916 AX Leeuwarden, NL. Contact: privacy@uncrush.app